amd64: always install grub-efi-amd64-signed

shim-signed does not depend on grub-efi-amd64-signed in Xenial.
Historically, Xenial did not always ship with signatures. This is
different than LTSes after Xenial where this is the case. A future SRU
for grub should change this, but for now ensure to install the signed
package so that secure boot systems can actually boot.

LP: #1901906

live-build/auto/config

@@ -503,6 +503,7 @@ case $PROJECT in
 				amd64)
 					add_package install grub-pc
 					add_package install shim-signed
+					add_package install grub-efi-amd64-signed
 					;;
 				armhf)
 					add_package install flash-kernel u-boot-tools

live-build/ubuntu-cpc/hooks.d/base/disk-image-uefi.binary

@@ -86,7 +86,7 @@ install_grub() {
             efi_target=arm64-efi
             ;;
         amd64)
-            chroot mountpoint apt-get install -qqy grub-pc shim-signed
+            chroot mountpoint apt-get install -qqy grub-pc shim-signed grub-efi-amd64-signed
             grub_modules="multiboot serial usb usb_keyboard"
             efi_target=x86_64-efi
             ;;